2e22a20d8696d250178c7a4cb2ebc59ff6970a303266212b971b9fe36f3c50d9 | Triage

Sharing

General

Target

2e22a20d8696d250178c7a4cb2ebc59ff6970a303266212b971b9fe36f3c50d9
Size

296KB
Sample

221123-vpdlgace5z
MD5

4c378a7d2164e6371c059883e9d21550
SHA1

c1dfcef22eec1e0552e034730ff3ae3fe19ec4f9
SHA256

2e22a20d8696d250178c7a4cb2ebc59ff6970a303266212b971b9fe36f3c50d9
SHA512

e6e4270755db63a5d61bd2ce88c1ce35bd4d4dd961fbfc505dd00cd984f0854d407047c5772081fd417e7a07864208d18062bf13f9c41b622ff7b97934275002
SSDEEP

6144:Uk6D1y0FXrKnvmb7/D26OJYPsMiqDJlJNwHG6s20EBb4jHX3QA/hwNGhWhThPvMc:UVD1y0F7Knvmb7/D265DJlJNwHG6JTb7

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  2e22a20d8696d250178c7a4cb2ebc59ff6970a303266212b971b9fe36f3c50d9
- Size
  
  296KB
- MD5
  
  4c378a7d2164e6371c059883e9d21550
- SHA1
  
  c1dfcef22eec1e0552e034730ff3ae3fe19ec4f9
- SHA256
  
  2e22a20d8696d250178c7a4cb2ebc59ff6970a303266212b971b9fe36f3c50d9
- SHA512
  
  e6e4270755db63a5d61bd2ce88c1ce35bd4d4dd961fbfc505dd00cd984f0854d407047c5772081fd417e7a07864208d18062bf13f9c41b622ff7b97934275002
- SSDEEP
  
  6144:Uk6D1y0FXrKnvmb7/D26OJYPsMiqDJlJNwHG6s20EBb4jHX3QA/hwNGhWhThPvMc:UVD1y0F7Knvmb7/D265DJlJNwHG6JTb7
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence